From: "Tim Pushor" <[EMAIL PROTECTED]> Date: Wed, 10 Apr 2002 10:35:39 -0600
While we're on the subject of SASL and authorization/authentication, if Cyrus IMAP has abstracted authentication through SASL, why is the group ACL still handled locally (in Cyrus) via UNIX groups or Kerberos? We have enough problems maintaining the authentication abstraction (SASL). Authorization is frequently even more site specific. While we've thought about working on an authorization library we haven't gotten even to the drawing board. I would really like to base group ACL's on the same scheme that authentication is using. I havn't looked at the source yet, as I am not wild about maintaining multiple hacks throughout Cyrus/Sasl. Well, these are really two different things. For instance, at CMU, we're moving (slowly) towards using Kerberos 5 for authentication and LDAP for authorization (across all of our applications). What is everyone else doing? Not using group ACL's or fudging UNIX groupfiles to include accounts defined somewhere else (like sasldb/ldap)? We currently use the PTS database from AFS. It would be cool to write an auth_ldap backend for Cyrus, but we haven't gotten the time to do it. (A seperate process like ptloader is probably the way to go.) Larry
